I looked at the OpenSSL api for this and it looks really horrible. What you actually *want* to do, if openssl is 1.0.1 or something, is try to use tls 1.2, if earlier you want to use tls 1.0. I don't think any reasonable version of openssl doesn't support tls 1.0, so we absolutely should not support sslv3 (and NEVER EVER sslv2).